Determining and providing representations of program flow control

Abstract

Determination and provision of improved representations of program flow control are provided by a method that monitors execution of binary code of a program on a computer system. The monitoring includes monitoring manipulation(s) of call stack(s) maintained by the computer system for the execution of the binary code. The method, based on the monitoring, determines function call pattern(s) and branch pattern(s) exhibited by the execution of the binary code. The method identifies, from the binary code and using the determined function call pattern(s) and branch pattern(s), function calls and branches, relations between the function calls and branches, and function and variable names. The method also provides a representation of program flow control of the program using the identified function calls and branches, relations, and function and variable names.

What is claimed is: 
     
       1. A computer-implemented method comprising:
 monitoring execution of binary code of one or more programs on a computer system, the monitoring comprising monitoring manipulation of at least one call stack maintained by the computer system for the execution of the binary code; 
 based on the monitoring, determining at least one function call pattern and at least one branch pattern exhibited by the execution of the binary code; 
 obtaining binary code of a target program and identifying, from the binary code of the target program, and using the determined at least one function call pattern and at least one branch pattern, function calls and branches, relations between the function calls and branches, and function and variable names; and 
 providing a representation of program flow control of the target program using the identified function calls and branches, relations, and function and variable names. 
 
     
     
       2. The method of  claim 1 , wherein the monitoring further comprises maintaining a buffer of most-recently executed instructions, and wherein the determining the at least one function call pattern and at least one branch pattern comprises providing, to a pattern recognition component, contents of the buffer upon manipulation of the program stack, wherein the pattern recognition component determines the at least one function call pattern and at least one branch pattern by through pattern recognition based at least in part on the provided buffer contents. 
     
     
       3. The method of  claim 2 , wherein the pattern recognition component comprises an artificial intelligence model trained based on featurizing sets of instructions, the artificial intelligence model configured to accept as input an n-dimensional input vector of instructions and predict a function call pattern or branch pattern based on the input n-dimensional input vector. 
     
     
       4. The method of  claim 2 , wherein the monitoring the execution of the binary code further comprises monitoring processor condition codes indicating conditions under which conditional branches are taken, wherein the at least one branch pattern comprises at least one conditional branch pattern reflecting a pattern under which a conditional branch is taken. 
     
     
       5. The method of  claim 4 , wherein the identifying identifies a relation between a function call and a conditional branch in the binary code of the target program, the relation indicating one or more conditions under which the function call is made. 
     
     
       6. The method of  claim 4 , wherein the determining the at least one function call pattern and at least one branch pattern comprises providing the processor condition codes to the pattern recognition component, wherein the pattern recognition component determines the at least one function call pattern and at least one branch pattern by pattern recognition based at least in part on the provided processor condition codes. 
     
     
       7. The method of  claim 1 , wherein the identifying the function and variable names comprises identifying, via an application programming interface, a function or variable name using a symbol table of the binary code, of the target program, that maps function and variable names to memory addresses. 
     
     
       8. The method of  claim 1 , wherein the providing the representation of program flow control comprises building and presenting in a graphical interface a call graph identifying functions of the binary code of the target program, calls as between the functions to indicate program flow, and conditions for branching from one function to another function of the binary code of the target program. 
     
     
       9. The method of  claim 8 , wherein the providing comprises obtaining an initial call graph indicating the functions of the binary code of the target program, and augmenting the initial call graph to graphically convey the calls as between the functions and the conditions for branching, the augmenting producing an augmented call graph, wherein the presenting presents the augmented call graph. 
     
     
       10. The method of  claim 1 , wherein the target program is one selected from the group consisting of (i) a program of the one or more programs, and (ii) a different program than each of the one or more programs. 
     
     
       11. A computer system comprising:
 a memory; and 
 a processor in communication with the memory, wherein the computer system is configured to perform a method comprising:
 monitoring execution of binary code of one or more programs on a computer system, the monitoring comprising monitoring manipulation of at least one call stack maintained by the computer system for the execution of the binary code; 
 based on the monitoring, determining at least one function call pattern and at least one branch pattern exhibited by the execution of the binary code; 
 obtaining binary code of a target program and identifying, from the binary code of the target program, and using the determined at least one function call pattern and at least one branch pattern, function calls and branches, relations between the function calls and branches, and function and variable names; and 
 providing a representation of program flow control of the target program using the identified function calls and branches, relations, and function and variable names. 
 
 
     
     
       12. The computer system of  claim 11 , wherein the monitoring further comprises maintaining a buffer of most-recently executed instructions, and wherein the determining the at least one function call pattern and at least one branch pattern comprises providing, to a pattern recognition component, contents of the buffer upon manipulation of the program stack, wherein the pattern recognition component determines the at least one function call pattern and at least one branch pattern by through pattern recognition based at least in part on the provided buffer contents. 
     
     
       13. The computer system of  claim 12 , wherein the pattern recognition component comprises an artificial intelligence model trained based on featurizing sets of instructions, the artificial intelligence model configured to accept as input an n-dimensional input vector of instructions and predict a function call pattern or branch pattern based on the input n-dimensional input vector. 
     
     
       14. The computer system of  claim 12 , wherein the monitoring the execution of the binary code further comprises monitoring processor condition codes indicating conditions under which conditional branches are taken, wherein the at least one branch pattern comprises at least one conditional branch pattern reflecting a pattern under which a conditional branch is taken, and wherein the identifying identifies a relation between a function call and a conditional branch in the binary code of the target program, the relation indicating one or more conditions under which the function call is made. 
     
     
       15. The computer system of  claim 14 , wherein the determining the at least one function call pattern and at least one branch pattern comprises providing the processor condition codes to the pattern recognition component, wherein the pattern recognition component determines the at least one function call pattern and at least one branch pattern by pattern recognition based at least in part on the provided processor condition codes. 
     
     
       16. The computer system of  claim 11 , wherein the providing the representation of program flow control comprises building and presenting in a graphical interface a call graph identifying functions of the binary code of the target program, calls as between the functions to indicate program flow, and conditions for branching from one function to another function of the binary code of the target program. 
     
     
       17. A computer program product comprising:
 a computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising:
 monitoring execution of binary code of one or more programs on a computer system, the monitoring comprising monitoring manipulation of at least one call stack maintained by the computer system for the execution of the binary code; 
 based on the monitoring, determining at least one function call pattern and at least one branch pattern exhibited by the execution of the binary code; 
 obtaining binary code of a target program and identifying, from the binary code of the target program, and using the determined at least one function call pattern and at least one branch pattern, function calls and branches, relations between the function calls and branches, and function and variable names; and 
 providing a representation of program flow control of the target program using the identified function calls and branches, relations, and function and variable names. 
 
 
     
     
       18. The computer program product of  claim 17 , wherein the monitoring further comprises maintaining a buffer of most-recently executed instructions, and wherein the determining the at least one function call pattern and at least one branch pattern comprises providing, to a pattern recognition component, contents of the buffer upon manipulation of the program stack, wherein the pattern recognition component determines the at least one function call pattern and at least one branch pattern by through pattern recognition based at least in part on the provided buffer contents. 
     
     
       19. The computer program product of  claim 18 , wherein the pattern recognition component comprises an artificial intelligence model trained based on featurizing sets of instructions, the artificial intelligence model configured to accept as input an n-dimensional input vector of instructions and predict a function call pattern or branch pattern based on the input n-dimensional input vector. 
     
     
       20. The computer program product of  claim 18 , wherein the monitoring the execution of the binary code further comprises monitoring processor condition codes indicating conditions under which conditional branches are taken, wherein the at least one branch pattern comprises at least one conditional branch pattern reflecting a pattern under which a conditional branch is taken, wherein the determining the at least one function call pattern and at least one branch pattern comprises providing the processor condition codes to the pattern recognition component, wherein the pattern recognition component determines the at least one function call pattern and at least one branch pattern by pattern recognition based at least in part on the provided processor condition codes, and wherein the identifying identifies a relation between a function call and a conditional branch in the binary code of the target program, the relation indicating one or more conditions under which the function call is made.